1. Attack the Key Own the Lock
by datagram & Schuyler Towne
Defcon 18 (2010)‏
Las Vegas, NV

2. About Us Datagram Schuyler TOOOL US Forensic locksmith NDE Magazine
Douchebag
No game shows :(
Schuyler
TOOOL US
NDE Magazine
Wheel of Fortune

3. How Locks Work

4. How Locks Work

5. How Locks Work

6. How Locks Work

7. Key Control
Availability of blanks
Distribution
Duplication/simulation

8. Attacking the Key Bitting depths/code Keyway Model of the lock
Additional security features

9. Physical Access to Keys
Holy Grail
Duration = Attack Quality
Wrist Impressioning

10. Direct Measurement
Key gauges
Micrometer
Calipers

11. Copy Impressioning

12. Copy Impressioning

13. Visual Access to Key
Sight reading
Estimation
Photography

14. Visual Access – UCSD

15. Visual Access - Diebold

16. Visual Access – NY MTA

17. Key Blanks Impressioning Overlifting “Reflecting” keys
Sectional keyways
Rake keys
Key bumping

18. Universal Handcuff Keys

19. Overlifting

20. Overlifting

21. Rake/Gypsy Keys

22. Impressioning

23. Impressioning
Works Forever!

24. Reflecting Keys

25. Sectional Keyways

26. Sectional Keyways

27. Incorrect Key Master key decoding Bumping Skeleton keys
Sidebar attacks
Passive component bypasses
Decoding attacks

28. Master Key Systems

29. Master Key Systems

30. Master Key Systems

31. Master Key Systems

32. Master Key Systems

33. Key Bumping Basic physics Specialized key Easy, effective
Vendor response

34. Pick Gun Mechanics

35. How Bumping Works

36. Creating Bump Keys Any key that fits
Cut “999” key (deepest pin depths)‏
Use key gauges
Cut with
Hand file, dremel, key cutter

37. Bump Keys

38. Key Bumping

39. Key Bumping

40. 100% Efficiency...?

41. Don't underestimate attackers...

42. Bumping Hammers

43. Side Pins

44. Side Pins

45. Side Pins

46. Side Pins

47. Side Pins

48. Regional Sidebar Attacks
ASSA Twin Combi
Schlage Primus
Fichet 480
The list goes on...
Schlage is doing it wrong.

49. One Last Way Schlage Is Doing It Wrong: LFIC
BEST SFIC
Small Format Interchangable Core
Schlage LFIC
6.5 Control Key

50. Passive Components

51. What have we learned?

52. Resources openlocksport.com lockwiki.com lockpickingforensics.com
ndemag.com

53. Meet us at Q&A!